Entitlement management and access control system

In a system having a plurality of accessors, at least one group having a name and having zero or more accessors as members, and at least one resource, a method for determining accessor entitlement to a resource in response to an accessor request for access to the resource, comprising the steps of:

• a) associating with the resource an entitlement expression including at least one group name;
• b) associating with each group a membership map indicating whether particular accessors are members of that group, the membership map being a bit map;
• c) associating with each accessor a unique identifier usable as an index into each group membership map to determine whether that accessor is a member of that group;
• d) evaluating an entitlement expression for the resource to determine the entitlement of the requesting accessor to the requested resource.

A system for determining accessor entitlement to a resource comprising:

• a) a first means for storing a plurality of accessors and a unique identifier associated with each accessor;
• b) a second means for storing a plurality of unique accessor group names, each of the plurality of accessor group names having an associated membership map, the accessor identifier acting as an index into the accessor group membership maps for determining whether an accessor is a member of an accessor group, the membership maps being bit maps;
• and
• c) a processor means for determining whether an accessor is entitled to a resource in response to an accessor request for the resource by evaluating an entitlement expression for the resource, the entitlement expression including a reference to at least one accessor group.

In a system having a plurality of accessors, at least one group having a name and having zero or more accessors as members, and at least one resource, a method for determining accessor entitlement to a resource in response to an accessor request for access to the resource, comprising the steps of:

• a) associating with the resource an entitlement expression including at least one group name;
• b) associating with each group a membership map indicating whether particular accessors are members of that group;
• c) associating with each group name a membership map identifier that represents the location of the membership map for the group;
• d) associating with each accessor a unique identifier usable as an index into each group membership map to determine whether that accessor is a member of that group;
• and
• e) evaluating an entitlement expression for the resource to determine the entitlement of the requesting accessor to the requested resource.

In a system having a plurality of accessors, at least one group having a name and having zero or more accessors as members, and at least one resource, a method for determining accessor entitlement to a resource in response to an accessor request for access to the resource, comprising the steps of:

• a) associating with the resource an entitlement expression including at least one group name;
• b) associating with each group a membership map indicating whether particular accessors are members of that group;
• c) associating with each accessor a unique name and a unique identifier usable as an index into each group membership map to determine whether that accessor is a member of that group, each accessor's name and unique identifier being stored in an accessor store;
• and
• d) evaluating an entitlement expression for the resource to determine the entitlement of the requesting accessor to the requested resource.